vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add APIs to "check mutex on windows" and "create or open mutex on windows" to reduce FNs (#1031)

Browse source
This commit is contained in:
Mike Hunhoff 2025-03-20 09:00:29 -06:00 • committed by GitHub
parent 48a553e1ca
commit 9acd31998f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

24
host-interaction/mutex/check-mutex-on-windows.yml
View file

@ -13,14 +13,16 @@ rule:
examples:
- 1d8fd13c890060464019c0f07b928b1a:0x402eb0
features:
- and:
- match: create or open mutex on Windows
- or:
- api: WaitForSingleObject
- basic block:
- and:
- api: GetLastError
- or:
- number: 2 = ERROR_FILE_NOT_FOUND
- number: 0xB7 = ERROR_ALREADY_EXISTS
- number: 5 = ERROR_ACCESS_DENIED
- or:
- api: ntdll.NtQueryMutant
- and:
- match: create or open mutex on Windows
- or:
- api: WaitForSingleObject
- basic block:
- and:
- api: GetLastError
- or:
- number: 2 = ERROR_FILE_NOT_FOUND
- number: 0xB7 = ERROR_ALREADY_EXISTS
- number: 5 = ERROR_ACCESS_DENIED

2
host-interaction/mutex/create-or-open-mutex-on-windows.yml
View file

@ -18,6 +18,8 @@ rule:
- api: kernel32.OpenMutex
- api: kernel32.CreateMutex
- api: kernel32.CreateMutexEx
- api: ntdll.NtCreateMutant
- api: ntdll.NtOpenMutant
- and:
- format: dotnet
- or: